# Optimized Production Dockerfile (multi-stage)
# Stage 1: Build
FROM maven:3.9-openjdk-21 AS builder
WORKDIR /app
COPY pom.xml .
RUN mvn dependency:go-offline -q  # cache deps layer separately
COPY src ./src
RUN mvn package -DskipTests -q

# Stage 2: Runtime (minimal image)
FROM eclipse-temurin:21-jre-alpine  # smaller: jre not jdk, alpine not ubuntu
WORKDIR /app
# Non-root user for security
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
USER appuser
COPY --from=builder /app/target/app.jar ./app.jar
EXPOSE 8080
# Use exec form (not shell form) for proper signal handling
ENTRYPOINT ["java", "-XX:+UseContainerSupport", "-jar", "app.jar"]

# docker-compose.yml — production-grade example
version: '3.9'
services:
  api:
    build: ./api
    image: myapp/api:latest
    ports:
      - "8080:8080"
    environment:
      - DB_HOST=postgres
      - REDIS_URL=redis://cache:6379
      - KAFKA_BROKERS=kafka:9092
    depends_on:
      postgres: { condition: service_healthy }  # wait until healthy
      cache:    { condition: service_started }
    restart: unless-stopped
    deploy:
      resources:
        limits:   { cpus: '0.5', memory: 512M }
        reservations: { memory: 256M }
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
      interval: 10s
      timeout: 5s
      retries: 3

  postgres:
    image: postgres:16-alpine
    volumes:
      - pg_data:/var/lib/postgresql/data  # named volume: persists data
    environment:
      POSTGRES_DB: mydb
      POSTGRES_USER: user
      POSTGRES_PASSWORD_FILE: /run/secrets/pg_password  # use secrets not env
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U user -d mydb"]
      interval: 5s
      retries: 5

  cache:
    image: redis:7-alpine
    command: redis-server --maxmemory 256mb --maxmemory-policy allkeys-lru

  kafka:
    image: confluentinc/cp-kafka:7.5.0
    environment:
      KAFKA_BROKER_ID: 1
      KAFKA_ZOOKEEPER_CONNECT: zookeeper:2181
      KAFKA_ADVERTISED_LISTENERS: PLAINTEXT://kafka:9092

volumes:
  pg_data:  # named volume managed by Docker (survives container restart)

# docker-compose up -d       -- start in background
# docker-compose logs -f api -- tail service logs
# docker-compose scale api=3 -- run 3 instances

# Named volume
docker run -v myapp_data:/var/lib/mysql mysql:8

# Bind mount (dev hot reload)
docker run -v $(pwd)/src:/app/src -v $(pwd)/node_modules:/app/node_modules node:20

# tmpfs (never written to disk)
docker run --tmpfs /tmp:size=100m,mode=1777 myapp

# Inspect volumes
docker volume ls
docker volume inspect myapp_data

# Backup volume
docker run --rm -v myapp_data:/source -v $(pwd):/backup alpine \
  tar czf /backup/backup.tar.gz -C /source .

# Production Deployment manifest
apiVersion: apps/v1
kind: Deployment
metadata:
  name: api-service
  labels: { app: api }
spec:
  replicas: 3
  selector: { matchLabels: { app: api } }
  strategy:
    type: RollingUpdate
    rollingUpdate: { maxSurge: 1, maxUnavailable: 0 }  # zero-downtime
  template:
    metadata: { labels: { app: api } }
    spec:
      containers:
      - name: api
        image: myapp/api:v1.2.3  # pin to digest in prod: @sha256:...
        ports: [{ containerPort: 8080 }]
        resources:
          requests: { cpu: "100m", memory: "256Mi" }  # scheduler uses this
          limits:   { cpu: "500m", memory: "512Mi" }  # OOMKilled if exceeded
        readinessProbe:   # traffic only when ready
          httpGet: { path: /ready, port: 8080 }
          initialDelaySeconds: 5
          periodSeconds: 5
        livenessProbe:    # restart if unhealthy
          httpGet: { path: /health, port: 8080 }
          initialDelaySeconds: 15
        env:
        - name: DB_PASSWORD
          valueFrom: { secretKeyRef: { name: db-secret, key: password } }
---
apiVersion: v1
kind: Service
metadata: { name: api-service }
spec:
  selector: { app: api }
  ports: [{ port: 80, targetPort: 8080 }]
  type: ClusterIP
---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata: { name: api-hpa }
spec:
  scaleTargetRef: { apiVersion: apps/v1, kind: Deployment, name: api-service }
  minReplicas: 3
  maxReplicas: 20
  metrics:
  - type: Resource
    resource: { name: cpu, target: { type: Utilization, averageUtilization: 70 } }

import boto3

dynamodb = boto3.resource('dynamodb')
table = dynamodb.Table('users')

# PutItem
table.put_item(Item={
    'user_id': 'u123',        # Partition key
    'email': 'user@example.com',
    'created_at': 1716825600,
    'profile': {'name': 'Alice', 'age': 30}
})

# GetItem (single item by PK)
response = table.get_item(Key={'user_id': 'u123'})
user = response['Item']

# Query (items in a partition)
response = table.query(
    KeyConditionExpression='user_id = :uid AND created_at BETWEEN :start AND :end',
    ExpressionAttributeValues={':uid': 'u123', ':start': 1700000000, ':end': 1716825600}
)

# Conditional write (atomic)
table.update_item(
    Key={'user_id': 'u123'},
    UpdateExpression='SET #st = :active',
    ConditionExpression='attribute_exists(user_id)',
    ExpressionAttributeNames={'#st': 'status'},
    ExpressionAttributeValues={':active': 'active'}
)

import json, boto3, os

def handler(event, context):
    # event: the triggering event payload (API GW request, S3 event, SQS message)
    # context: runtime info (function name, memory limit, remaining time)
    
    # Trigger sources: API Gateway, S3, SQS, SNS, DynamoDB Streams, EventBridge,
    #                  Kinesis, ALB, Cognito, Step Functions, CloudWatch Events

    # Example: S3 trigger
    for record in event.get('Records', []):
        bucket = record['s3']['bucket']['name']
        key    = record['s3']['object']['key']
        # Process file...
    
    # Warm vs Cold start
    # Cold start: ~100ms (Python) to ~1s (Java) for first invocation after idle
    # Warm: subsequent invocations reuse container (~1ms overhead)
    
    return {
        'statusCode': 200,
        'headers': {'Content-Type': 'application/json'},
        'body': json.dumps({'message': 'Success'})
    }

# Best practices:
# - Initialize clients outside handler (reused across warm invocations)
db_client = boto3.client('rds-data')  # module-level initialization!

// Least-privilege policy: Lambda can only read from specific S3 bucket
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:ListBucket"],
      "Resource": [
        "arn:aws:s3:::my-bucket",
        "arn:aws:s3:::my-bucket/*"
      ],
      "Condition": {
        "StringEquals": { "s3:prefix": ["uploads/"] }
      }
    }
  ]
}